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This pedagogical review presents the proof of the Solovay-Kitaev theorem in the form of 
an efficient classical algorithm for compiling an arbitrary single-qubit gate into a sequence 
of gates from a fixed and finite set. The algorithm can be used, for example, to compile 
Shor's algorithm, which uses rotations of Tr/2 k , into an efficient fault-tolerant form using 
only Hadamard, controlled-NOT, and n/8 gates. The algorithm runs in 0(log 2 ' 71 (l/e)) 
time, and produces as output a sequence of 0(log 3 ' 97 (l/e)) quantum gates which is 
guaranteed to approximate the desired quantum gate to an accuracy within e > 0. We 
also explain how the algorithm can be generalized to apply to multi-qubit gates and to 
gates from SU(d). 
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1 Introduction 

"I have been impressed by numerous instances of mathematical theories that are 
really about particular algorithms; these theories are typically formulated in math- 
ematical terms that are much more cumbersome and less natural than the equiva- 
lent formulation today's computer scientists would use." — Donald E. Knuth 1 (i 

The Solovay-Kitaev (SK) theorem is one of the most important fundamental results in the 
theory of quantum computation. In its simplest form the SK theorem shows that, roughly 
speaking, if a set of single-qubit quantum gates generates a dense subset of SU(2), then that 
set is guaranteed to fill SU(2) quickly, i.e., it is possible to obtain good approximations to 
any desired gate using surprisingly short sequences of gates from the given generating set. 

The SK theorem is important if one wishes to apply a wide variety of different single-qubit 
gates during a quantum algorithm, but is restricted to use gates from a more limited reper- 
toire. Such a situation arises naturally in the context of fault-tolerant quantum computation, 
where direct fault-tolerant constructions are typically available only for a limited number of 
gates (e.g., the Clifford group gates and tt/8 gate), but one may wish to implement a wider 
variety of gates, such as the ir/2 k rotations occurring in Shor's algorithm [221 [23]. In this sit- 
uation one must use the limited set of fault-tolerant gates to build up accurate fault-tolerant 
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approximations to all the gates used in the algorithm, preferably in the most efficient manner 
possible. The SK theorem tells us that such efficient constructions are possible. 

The purpose of the present paper is to present the proof of the SK theorem in the form of 
a concrete algorithm which can be used to approximate a desired unitary, U, using a given set 
of quantum gates. We believe that this algorithmic perspective is useful in its own right, and, 
as the quote by Knuth suggests, also makes the ideas behind the SK theorem considerably 
easier to understand than in previous presentations. However, we stress that the paper is a 
review paper, as all the essential ideas appear in previous work; a detailed history of the SK 
theorem and algorithm is given in Section 

The structure of the paper is as follows. Section El introduces the fundamental defini- 
tions needed to understand the SK theorem and algorithm, and provides a formal statement 
of the SK theorem. Section explains the SK algorithm for qubits, in the form of nine 
easily-understood lines of pseudocode. This section concentrates on developing a broad un- 
derstanding of how the SK algorithm works. The few remaining details of the algorithm which 
need verification are explained in Section Section extends the algorithm so it applies also 
to qudits, i.e., quantum systems with c£-dimensional state spaces. As a special case we ob- 
tain a version of the SK algorithm applicable to multiple qubits, simply by setting d = 2™. 
Section El discusses the relationship of the results we have presented to prior work on the SK 
theorem. This placement of the discussion of prior work is perhaps somewhat unusual, and 
deserves comment: we chose to defer the discussion until late in the paper in order to make 
the comparisons between the present paper and prior work as concrete and transparent as 
possible. Section [7| concludes. 

2 Fundamentals 

In this section we introduce the fundamental definitions necessary to understand the SK 
theorem and algorithm, and give a precise statement of the SK theorem. 

The basic goal of the SK algorithm is to take an arbitrary quantum gate U and find a 
good approximation to it using a sequence of gates <?i , . . . , g m drawn from some finite set 
Q. In analogy with classical computation, where an algorithm written in a programming 
language such as C or Perl must be compiled into a sequence of instructions in the native 
machine language, we will call the set Q of quantum gates an instruction set, and the process 
of finding good approximations compilation. Note that while this nomenclature, introduced 
in POj) is inspired by classical computer science, the analogies between the classical and 
quantum concepts are obviously somewhat imprecise, and should not be taken too seriously. 

Let's define these concepts more precisely, beginning with instruction sets: 
Definition 1 An instruction set Q for a d-dimensional audit is a finite set of quantum 
gates satisfying: 

1. All gates g e Q are in SU(d), that is, they are unitary and have determinant 1. 

2. For each g S Q the inverse operation g' is also in Q . 

3. Q is a universal set for SU(d), i.e., the group generated by Q is dense in SU(d). This 
means that given any quantum gate U S SU (d) and any accuracy e > there exists a 
product S = <7i . . . g m of gates from Q which is an e- approximation to U . 
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The notion of approximation being used in this definition, and throughout this paper, is 
approximation in operator norm. That is, a sequence of instructions generating a unitary 
operation S is said to be an e- approximation to a quantum gate U if d(U,S) = \\U — S\\ = 
su P||,/,||=i || (U — S)tp\\ < e. In different contexts we will find it convenient to use both the 
operator norm || • ||, and the associated distance function d(-, •). Another convenient notation 
is to use S to refer both to a sequence of instructions, gx,g2,-- ■ g m , and also to the unitary 
operation g\g2 ■ ■ ■ g m corresponding to that sequence. With this convention the "sequence" 
gx, P2j • • ■ corresponds to the unitary formed by applying gx, 52 > • • • in the reverse order. While 
this is somewhat nonintuitive, in later use it will prove to be the simplest and most natural 
convention. 

We assume the reader is familiar with the elementary properties of the operator norm, 
which we will mostly use without note. One perhaps somewhat less familiar property we'll 
have occasion to use is that if H is Hermitian then d(I, exp(iH )) = max^ 2 sin(|£J|/2), where 
the maximum is over all eigenvalues E of H. From this it follows easily that d(I,exp(iH)) < 
\\H\\. Furthermore, provided all the eigenvalues are in the range —tt to it it follows that 
d(/,ex P (* J ff)) = || J ff||+0(||iJ|| 3 ). 

It is easy to understand the motivation behind parts 1 and 3 of our definition of an 
instruction set. Less clear is the reason for part 2, namely, the requirement that if g € Q 
then we must also have g^ €E Q. Our reason for imposing this requirement is that it is used in 
the proof of the SK theorem, not for any a priori reason. In particular, we will make use of 
the easily-verified fact that if we have an instruction sequence providing an e-approximation 
to some unitary U , then we can obtain an e-approximation to U' simply by reversing the 
order of the sequence, and applying the corresponding inverse instructions. It appears to be 
an open problem whether a result analogous to the SK theorem holds when condition 2 is 
relaxed. 

The problem of quantum compilation may now be stated more precisely: given an in- 
struction set, Q, how may we approximate an arbitrary quantum gate with a sequence of 
instructions from Q; how does the sequence length increase as we require more accurate ap- 
proximations; and how quickly may we find such an approximating sequence? These final two 
questions are vitally important, as an inaccurate or inefficient quantum compiler may negate 
any improvements quantum computers have over classical computers. 

As an illustration, suppose we have a quantum algorithm, such as Shor's, which can be 
broken up into a sequence of m quantum gates, Ux, ■ ■ ■ , U m . However, let us also suppose that 
not all of those quantum gates are in our instruction set, and so it is necessary to compile 
the algorithm so that each gate Uj is re-expressed in terms of the available instruction set. 
If the compiled algorithm is required to approximate the original to within e, then it is 
sufficient that each gate Uj be approximated to an accuracy e/m If we make the a 
priori reasonable assumption |2U) that an accuracy of <5 > requires an instruction sequence 
of length 0(1/5), then each gate Uj will require a sequence of length 0(m/e), and so the 
total number of instructions required to implement the algorithm is 0(m 2 /e) — a quadratic 
increase in the complexity of the algorithm. For quantum algorithms such as Grover's search 
algorithm which purports to give a quadratic increase over the best classical algorithm, 

this may be problematic if the available instruction set does not coincide with the gates used 
in the algorithm. 
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The SK theorem may be stated as follows: 

Theorem 1 (Solovay-Kitaev) Let Q be an instruction set for SU(d), and let a desired 
accuracy e > be given. There is a constant c such that for any U £ SU(d) there exists a 
finite sequence S of gates from Q of length 0(log c (1/e)) and such that d(U, S) < e. 

Different proofs of the theorem give different values for c; the proof we describe gives 
c « 3.97. We discuss some other proofs (and their corresponding values of c) in Section |SJ 

A critical issue not addressed in this statement of the SK theorem is the question of 
how efficiently the approximating sequence S may be found on a classical computer. The 
SK algorithm both provides a proof of the SK theorem, and also shows that an approxi- 
mating sequence S may be found efficiently on a classical computer, with a running time of 
0(log 271 (l/ e )). 

At first sight it appears paradoxical that the SK algorithm can produce as output a 
gate sequence of length 0(log 3 ' 97 (l /e)) in the asymptotically shorter time 0(log 2 ' 71 (l/e)). 
We will see that the reason this is possible is because the gate sequence has considerable 
redundancy, enabling the output to be substantially compressed, i.e., not all the gates need 
be explicitly output. When this compression is not done, the SK algorithm runs instead in 
time 0(log 3 ' 97 (l/e)). Regardless of which method is used, the key point is that the running 
time is polylogarithmic in 1/e. 

Returning to our earlier example, suppose we have a quantum algorithm expressed in 
terms of quantum gates Ux, . . . , U m . If we wish for the compiled algorithm to have accuracy 
e, then each gate needs accuracy e/m. Using the SK algorithm this can be achieved using 
a sequence of 0(log 3 ' 97 (m/e)) quantum gates, and a running time of 0(log 2 ' 71 (m/e)) on a 
classical computer. The total number of instructions required to implement the algorithm is 
therefore 0(mlog 3 ' 97 (m/e)), with an associated classical compile time of 0(mlog 2 ' 71 (m/e)). 
Thus, the SK algorithm reduces the overhead due to quantum compilation from quadratic to 
polylogarithmic, which is much more acceptable. 

3 The Solovay-Kitaev algorithm for qubits 

In this section we present the main ideas used in the SK algorithm. At the conclusion of the 
section the reader should have a good broad understanding of how and why the algorithm 
works. Rigorous verification of a few details has been deferred until the next section, in order 
that those details not obscure the big picture. We also restrict our attention in this section to 
that form of the SK theorem which applies to qubits. The extension to qudits involves some 
new ideas, and is described in Section [5] 

The SK algorithm may be expressed in nine lines of pseudocode. We explain each of these 
lines in detail below, but present it here in its entirety both for the reader's reference, and to 
stress the conceptual simplicity of the algorithm: 

function Solovay-Kitaev(Gate U, depth n) 
if (n==0) 

Return Basic Approximation to U 
else 

Set ?7 n _i = Solovay-Kitaev (£/,n — 1) 
Set V, W = GC-Decompose(i7C/t_ 1 ) 
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Set V n -i = Solovay-KitaevCF.n — 1) 
Set W n -i = Solovay-KitaevW.n- 1) 
Return U n = V n _i W^-iV^ W\_JJ n - X ; 

Let's examine each of these lines in detail. The first line: 

function Solovay- Kitaev(Gate U , depth n) 

indicates that the algorithm is a function with two inputs: an arbitrary single-qubit quan- 
tum gate, U , which we desire to approximate, and a non-negative integer, n, which controls 
the accuracy of the approximation. The function returns a sequence of instructions which 
approximates U to an accuracy e„, where e„ is a decreasing function of n, so that as n gets 
larger, the accuracy gets better, with e n — > as n — > oo. We describe e„ in detail below. 

The Solovay-Kitaev function is recursive, so that to obtain an e„-approximation to U, 
it will call itself to obtain e„_i-approximations to certain unitaries. The recursion terminates 
at n = 0, beyond which no further recursive calls are made: 

if (n == 0) 

Return Basic Approximation to U 

In order to implement this step we assume that a preprocessing stage has been completed 
which allows us to find a basic eo-approximation to arbitrary U E SU(2). Since eo is a 
constant, in principle this preprocessing stage may be accomplished simply by enumerating 
and storing a large number of instruction sequences from Q, say up to some sufficiently large 
(but fixed) length Iq, and then providing a lookup routine which, given U, returns the closest 
sequence. Appropriate values for eo and Iq will be discussed later in this section. 

At higher levels of recursion, to find an e n -approximation to £/, we begin by finding an 
e„_i-approximation to U : 

else 

Set U n -i = Solovay-Kitaev([/,n — 1) 

We will use U n -i as a step towards finding an improved approximation to U. Defining 
A = UU^ l _ 1 , the next three steps of the algorithm aim to find an e„-approximation to A, 
where e„ is some improved level of accuracy, i.e., e„ < e n _i. Finding such an approxima- 
tion also enables us to obtain an e„-approximation to U, simply by concatenating our exact 
sequence of instructions for U n -i with our e„-approximating sequence for A. 

How do we find such an approximation to A? First, observe that A is within a distance 
e„_i of the identity. This follows from the definition of A and the fact that U n -i is within a 
distance e n ~i of U . 

Second, decompose A as a group commutator A = VWV^W^ of unitary gates V and 
W. For any A it turns out — this is not obvious — that there is always an infinite set of 
choices for V and W such that A = VWV^W^ . For our purposes it is important that we 
find V and W such that d(I, V), d(I, W) < c gCA /e„_i for some constant c gc . We call such 
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a decomposition a balanced group commutator. In Subsection 14.11 we will use the fact that 
d(I, A) < e n _i to show that such a balanced group commutator can always be found: 

Set V, W = GC-DecomposeCC/t/^) 

For practical implementations we will see below that it is useful to have c gc as small as 
possible; the arguments of Subsection 14. II show that c gc w 1/V2. 

The next step is to find instruction sequences which are e„_i-approximations to V and W: 



Set V n -i = Solovay-KitaevCI^.n — 1) 
Set W n -i = Solovay-Kitaev(IF,n — 1) 



Remarkably, in Subsection 14. 21 we show that the group commutator of V n -i and W n —i turns 

3/2 

out to be an e n = c a pp r o X e„_i-approximation to A, for some small constant c a pp rox . Provided 
e n _i < l/c approx , we see that e„ < e„_i, and this procedure therefore provides an improved 
approximation to A, and thus to U. This is surprising, since we are using imperfect ap- 
proximations to V and W to obtain an improved approximation to the group commutator 
VWV^W^ . We will see in Subsection 14.21 that the reason this improved approximation is 
possible is because of cancellation of error terms in the group commutator. 

The constant c a p prox is important as it determines the precision eo required of the initial 
approximations. In particular, we see that for this construction to guarantee that eo > £i > • • ■ 
we must have eo < l/c approx . Following the discussion in Subsection l4.2l we obtain 



appro X ' x vv tiic uio^uoDiun in kj li uQctiimi i i . vvc uuiain C a pp roX ^ 

4^2 and therefore require eo < 1/32. Of course, the analysis in Subsection 14. 21 simply 
bounds c a p prox , and it is possible that a more detailed analysis will give better bounds on 
c a ppro X , and thus on eo- Numerically we have found that for the single-qubit instruction set 
consisting of the Hadamard gate, the tt/8 gate, and its inverse, eo ~ 0.14 and Zo = 16 is 
sufficient for practical purposes. 

The algorithm concludes by returning the sequences approximating the group commuta- 
tor, as well as U n —i: 

Return U„ = V^W^V^W^U^; 

Summing up, the function Solovay-Kitaev (U, n) returns a sequence which provides an 

3/2 

£n = Capproxe^^-approximation to the desired unitary U. The five constituents in this se- 
quence are all obtained by calling the function at the n — 1th level of recursion. 

Analysis: We now analyse the runtime of the SK algorithm, and the accuracy of the 
approximating sequence of instructions. Let l n be the length of the sequence of instructions 
returned by Solovay-Kitaev(U, n), and let t n be the corresponding runtime. Inspection of 
the pseudocode and the above discussion shows that we have the recurrences 

C a pprox€ n _i V / 

In = 5/„_! (2) 

t n < 3£„_i + const, (3) 
where the constant overhead in t n comes from the need to perform tasks like finding the 
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balanced group commutator, and other small overheads in the pseudocode. Note that the 
cost of doing t n is assumed to come entirely from the calls to Solovay-Kitaev( . , n-1) , and 
we have assigned a constant cost for the final line of the algorithm, which returns the new 
sequence U n . This assumption is justified if the final line is implemented using pointers to the 
output from the earlier calls to Solovay-Kitaev( . , n-1), rather than returning an actual 
sequence of gates. This enables us to avoid explicitly returning the (redundant) sequences 
for V^_i and Wj l _ 1 . If this is not done, then this analysis needs a little modification; we 
won't go through the details, but the end result is that the time and length both scale as 
0(log 3 ' 97 (l/e)). Assuming that pointers have been used, the recurrences above imply: 

1 2 ( ~ ) " 

e n = — ( e O c approx) • (4) 

^approx 

In = 0(5") (5) 
tn = 0(3"). (6) 

To obtain a given accuracy e it follows that we must choose n to satisfy the equation: 

In 



ln(l/£ c a 



ln(3/2) 



(7) 



Substituting this value of n back into Eqs. (J5J and @ we obtain expressions for the length of 
the approximating sequence and the time of execution, now as a function of e rather than n: 

l e = O (ln ln5/ln(3/2) (l/e)) (8) 
t e = 0(ln lll3 / ln ( 3 / 2 )(l/e)). (9) 

These are the desired expressions for the length and execution time. Note that the exponent 
in the first expression is ln5/ln(3/2) ss 3.97, while the exponent in the second expression is 
ln3/ln(3/2) fa 2.71. 

A caveat to this discussion is that we have entirely ignored the precision with which 
arithmetical operations are carried out. In practice we cannot compute with precisely specified 
unitary operations, since such operations in general require an infinite amount of classical 
information to specify. Instead, we must work with approximations to such operations, and do 
all our calculations using finite precision arithmetic. A complete analysis of the SK algorithm 
should include an account of the cost of such approximations. In practice, we have found that 
for the values of precision of most interest to us, standard floating-point arithmetic works 
admirably well, and there seems to be little need for such an analysis. 



4 Verification of details 

In this section we verify those details of the SK algorithm not fully explained in the previous 
section. Subsection 14.11 describes how to find balanced group commutators generating a 
desired unitary, while Subsection 14. 21 discusses the error in the group commutator VWV^W^ 
when only approximations to the constituent unitaries are available. 
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4-1 Balanced commutators in SU(2) 

The earlier discussion of balanced group commutators was in a somewhat specialized nota- 
tion, which arose out of the application to the Solovay-Kitaev algorithm. To emphasize the 
generality of the results in this subsection we will use a more generic notation. In particular, 
suppose U E SU(2) satisfies d(I, U) < e. Our goal is to find V and W so that the group com- 
mutator satisfies VWV'W'' = U, and such that d(I,V),d(I,W) < c gc y/e for some constant 
c gc - 

In order to find such a V and W we first examine what seems like a special case. In 
particular, we choose V to be a rotation by an angle c/> about the x axis of the Bloch sphere, 
and W to be a rotation by an angle <j) about the y axis of the Bloch sphere. The resulting 
group commutator VWV^W^ is a rotation about some axis h on the Bloch sphere, by an 
angle 9 satisfying: 

sin(0/2) = 2sin 2 (0/2)y / l-sin 4 (0/2). (10) 

There are many ways of verifying Eq. IjlUI) . including simple brute force calculation, perhaps 
with the aid of a computer mathematics package. One somewhat more elegant way of verifying 
Eq. (|10l) is as follows. First, observe that is a rotation by an angle <j> about the — x axis, 
and thus WV^W^ must be a rotation by an angle <j> about the axis rh that results when —x 
is rotated by an angle <p about the y axis. That is, m(— cos(0), 0,sin(</>)). The commutator 
V r (WV'Wt') is thus the composition of these two rotations. The resulting angle of rotation is 
easy to calculate (see, e.g., Exercise 4.15 on page 177 of OH), with Eq. (|TU)) the result after 
some simplification. The exact form of the axis of rotation, n, is not so important for our 
purposes, but it is easily computed using similar techniques. 

We can easily invert this construction. Suppose now that U is a rotation by an arbitrary 
angle 9 about an arbitrary axis p on the Bloch sphere. Define <\> to be a solution to Eq. (|10(l 
for the given value of 0, and define V and W to be rotations by </> about the x and y axes of 
the Bloch sphere. Then it is easy to see that U must be conjugate to a rotation by 9 about 
the n axis identified in the previous two paragraphs, i.e., U — S{VWV^W^)S\ for some 
easily-computed unitary S. It follows that 

U = VWV f W f , (11) 

where V = SyS^ and W = SWS^ . Thus, we can express any unitary U rotating the Bloch 
sphere by an angle 9 as the group commutator of unitaries V and W which rotate the Bloch 
sphere by an angle <f>, providing 9 and <f> are related by Eq. I|10|) . 

To conclude the argument, note that for a unitary T rotating the Bloch sphere by an angle 
r, the distance to the identity satisfies d(I,T) = 2sin(r/4) = r/2 + 0(t 3 ). Combining this 
observation with Eq. (|10|l , we see that for U near the identity we can express U in terms of a 
group commutator of V and W satisfying d(I, U) ~ 2d(I, V) 2 = 2d(I, W) 2 . That is, we have: 

U = VWV^W^ (12) 
d(I,V) = d(I,W) « ^^M1<^1. (13) 

This is the desired balanced group commutator, and gives c gc ~ l/v2- This argument can 
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also easily be modified to give a more rigorous bound on c gc . The details are tedious, but 
easy to supply, and so we won't do this here. 

4-2 Approximating a commutator 

Just as in the last subsection, for clarity we state the main result of this subsection in general 
terms, rather than in the special notation used in Section 

Lemma 1 Suppose V, W, V, and W are unitaries such that d(V,V), d(W,W) < A, and also 
d(I,V),d(I,W) < 6. Then: 

d{VWV^W\ VWV^W^) < 8AS + 4A<5 2 + 8A 2 + 4A 3 + A 4 . (14) 

In applying this lemma to the SK algorithm, we replace A by e n _i, and S by Cg C ^/e„_i. 
This gives rise to the inequality: 

d{VWV^W\ VWV^W*) < cappro.e 3 ^, (15) 

where c a p prox ~ 8c gc . With a little more detailed work we can modify this argument to give 
a rigorous upper bound on c approx . However, just as in the last subsection, the details of this 
argument are tedious and not especially enlightening, but easy to supply, and so we won't do 
this here. 

Proof: We begin by writing V = V + Ay, WW + Aw, which gives: 

VWft = VWVW + A v WV^W^ + VAwV^W^ + VWA V W^ + VWV^ A w 

+0(A 2 ) + 0(A 3 ) + 0(A 4 ). (16) 

The <3(A 2 ) terms are terms like AyAwV^W 1 * . There are ( 4 ) = 6 such terms. The <3(A 3 ) 
terms are terms like AyAjyAy W^, of which there are (3) = 4 terms. There is just a single 
0(A 4 ) term, AyAjyAyAj^. It follows from these observations, Eq. (|16(l . and the triangle 
inequality that: 

d(VWV*W\VWVW) < ||AyWV t W t + VA W VW + VWA i v W t + VWV f A w \\ 

+6A 2 + 4A 3 + A 4 . (17) 

To complete the proof it suffices to prove that ||AyWV t W't + V'W'A v W' t || < A 2 +4A5+2AS 2 
and HVTWV^W^ + VWVtA^H < A 2 + 4A5 + 2A5 2 . The proofs of the two results are 
analogous, with the roles of V and W interchanged, and so we only provide the details of the 
first proof. We expand W — I + 5yy, so that 

Ay WV*W* + VWAyW^AyV^ + VA V + O(AS) + 0(A6 2 ). (18) 

In this expression the O(AS) terms are terms like Ay<5iy V' W' . By inspection we see that 
there are four such terms. The 0(A6 2 ) terms are terms like AVSwV^Sty: and, again by 
inspection, we see that there are two such terms. It follows that: 

|| Ay WVW + VWA f v W^\\ < || Ay V f + VAlW + 4AS + 2AS 2 . (19) 

The unitarity of V and V + Ay implies that Ay + VA V = — Ay Ay. Combining these 
observations and using the triangle inequality we obtain 

|| A v WV^W* + VWA V W^\\ < A 2 + 4A6 + 2AS 2 , (20) 

which completes the proof of the lemma. 
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5 The Solovay-Kitaev algorithm for qudits 

In this section we present a generalization of the SK algorithm that can be applied to qudits, 
i.e., to d x d unitary gates. The main difference is in the group commutator decomposition. 
In Subsection l5.1l we give a broad description of the modified algorithm, and in Subsection l5.2l 
we describe the modified group commutator decomposition. 

5.1 The modified algorithm 

The modified pseudocode for the qudit SK algorithm is as follows: 

function Solovay-Kitaev(Gate U, depth n) 
if (n == 0) 

Return Basic Approximation to U 
else 

Set U n -i = Solovay-Kitaev (£/,n — 1) 
Set V, W = GC-Approx-DecomposeCC/t/^) 
Set V n -i = Solovay-KitaevCI^.n — 1) 
Set W n -i = Solovay-KitaevCVF.n — 1) 

Return U„ = K,- 1 W r „_i^ t _ 1 W T [_ 1 U'n_i j 

Comparing with the earlier pseudocode for the qubit SK algorithm, we see that the only 
explicit difference is in the line taking the group commutator: 

Set V, W = GC-Approx-Decompose([/C/ ) J_ 1 ) 

Recall that in the qubit algorithm the corresponding line finds a balanced group commu- 
tator decomposition, i.e., finds V and W such that (a) VWV^W^ = A = UU\_ X , and (b) 
d(I, V), d(I, W) < c gc% /e„_i for some constant c gc . 

In the qudit algorithm this line finds a balanced group commutator which approximates A. 
More precisely, we find V and W such that (a) d(VWV^W\ A) < c % d<?l-\, for some constant 
Cg C ', and (b) d(I, V), d(I, W) < c gc "^/e n -i for some constant c gc ». The explicit procedure for 
doing this is explained in Subsection 15.21 which shows that c gc ' w 4d 3 / 4 ((<i — l)/2) 3 / 2 and 
c gc » <i 1 / 4 ((<i — l)/2) 1 / 2 , where d is the dimensionality of the Hilbert space we are working 
in. 

The remaining lines work just as in the qubit algorithm, finding instruction sequences V n -i 
and W n —i which arc e„_i-approximations to A, and then returning the group commutator 
corresponding to those sequences, together with the sequence for f/„-i, as the output of the 
algorithm: 

Set V n -i = Solovay-Kitaev(y,n — 1) 
Set W n -i = Solovay-Kitaev(IT,n — 1) 

Return U n = Vn-iWn-lV^W^Un-U 

Although the steps are the same, the analysis is a little different, due to the fact that the 
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group commutator of V and W only approximates A. In particular, we have 

d(V n - 1 W n -iV^_ 1 wl_ 1 ,A) < diVn-iWn-iV^W^VWVW) + d(VWV f W f ,A) 

(21) 

< (Cg c ' + C a pp r ox) £ n _i, (22) 

where c a p pr ox is the same constant that arose in the qubit algorithm ( Subsection 14 . 2(1 . where 
we estimated c approx ~ 8c gc ", in the notation of the current section. Thus, just as for the 
qubit algorithm, the qudit algorithm returns a sequence U n which provides an e„ = 0(e 3 / 2 1 )- 
approximation to the desired unitary, U. Furthermore, the five constituents in the sequence 
are all obtained by calling the function at the n — 1th level of recursion, just as in the qubit 
algorithm. 

The analysis of the accuracy and running time of the qudit SK algorithm proceeds in 
a fashion analogous to the qubit algorithm, giving l c = O (lii ln5 ^ ln ^ 3 ^ 2 \l/e)j and t c = 

O (ln ln3/ln(3/2) (l/e)). An important practical caveat concerns the difficulty of construct- 
ing the lookup table used to obtain the basic eo-approximations. This is done by enumerating 
all possible gate sequences up to some sufficient length. SU(d) is a manifold of dimension 
d 2 — 1 , so if we wish to approximate every gate in SU (d) to within eo then we generate 
0(1/cq _1 ) sequences. For an instruction set Q there are 0(|£|') sequences of length < I, 
some fraction of which may be redundant. We will therefore need to enumerate all sequences 
up to a length Iq satisfying 

I >of^ilog(l/eo)V (23) 



The complexity of the enumeration is exponential in Iq and thus scales quite poorly with 
d. While our algorithm is practical for the small values of d of most interest in applications 
to fault-tolerance (e.g., d = 2,3,4), it will require great computational effort to scale it to 
substantially larger values of d. 

5.2 Balanced commutators in SU(d) 

In this subsection our goal is to show that if U satisfies d(I, U) < e then there exist V and 
W satisfying d{VWV^W\U) < c gc ,e 3 / 2 and such that d(I,V),d(I,W) < c gc „^, for some 
constants c gc ' and c gc ". The proof combines two lemmas. 

Lemma 2 (Based on Theorem 4-5.2 on page 288 of ]1 Let H be a traceless d- dimensional 
Hermitian matrix. Then we can find Hermitian F and G such that: 

[F,G] = iH (24) 

\\F\l\\G\\ < rf V4 (^) #!• (25) 

A variant of this lemma may be found in Problem 8.15 on page 79 of |14|. The variant 
in ^1] has the advantage that the prefactor to on the right-hand side of Eq. I|25|) is 

replaced by a constant that does not depend on d. We use the present version since the proof 
is a little simpler, and it suffices to establish the correctness of the SK algorithm. Readers 
serious about optimizing this aspect of the SK algorithm should consult for details. 



12 The Solovay-Kitaev algorithm 



Proof: It is convenient to work in a basis which is Fourier conjugate to the basis in which 
H is diagonal. (This can, of course, be done, since the commutator bracket is preserved under 
conjugation, i.e., S[A,B]S' = [SAS',SBS'] for any matrices A and B, and any unitary S.) 
In this basis H has the representation 

H = Wding(E 1 ,...,E d )W\ (26) 

where Ei, . . . ,Ea are the eigenvalues of H, and W is the Fourier matrix, with elements 
Wjk = U}i k /\d, where to = exp(27ri/d) is a dth root of unity. From Eq. H26(l we see that in 
this basis the diagonal matrix elements of H vanish: 

J2 k ^ k E k ^* J2 k E k tr(H) 

H " ~ d = ~d— --d~-°- (27) 

As a trial solution to the equation [F, G] = iH we will assume that G is some diagonal matrix, 
with real entries. The condition [F,G]iH is then equivalent to iHjk = Fjk(Gkk — Gjj)- This 
suggests imposing the condition that the diagonal entries of G all be distinct, and defining 

{ lH ^ if A -L I,. 

r- G - Zil < 28 > 

It is easy to see that with these choices F and G are Hermitian, and satisfy [F, G] = iH. 

What of the norms ||F|| and ||G||? Suppose we choose the diagonal entries of G as —(d — 
l)/2, — (d — l)/2 + 1, . . . , (d — l)/2. With this choice it is clear from our definition that the 
entries of F satisfy \Fjk\ < l-^jfel, and we have 

ll^ll 2 < tr^ 2 ) (29) 

< tr{H 2 ) (30) 

< 4Hf, (31) 

where the first and third inequalities follow easily from the definitions, and the second in- 
equality follows from the fact that \Fjk\ < \Hjk\- With these choices we therefore have 
11-^11 < V d\\H\\ and ||G|| = (d — l)/2. Rescaling F and G appropriately we can ensure that 
the equation [F, G] = iH remains satisfied, while satisfying Eq. (|25J) . This completes the 
proof. 

Lemma 3 Suppose F and G are Hermitian matrices such that \\F\\, \\G\\ < 5. Then: 

d(exp(iF)exp(iG)exp(-iF)exp(-iG),exp(i x i[F, G])) < ci<5 3 , (32) 

for some constant c\ ~ 4. 

Proof: This is easily verified using the standard series expansion for matrix exponentials. 
Alternately, this is also a standard result in the theory of Lie groups. See, e.g., Proposition 2 
on page 25 in Section 1.3 of \2l\ . 

The result we desire may be obtained by combining these two lemmas. Suppose e?(7, U) < 
e. We can find Hermitian H such that U exp(i#) and d(I, U) = \\H\\ + 0(||#|| 3 ). By 
Lemma|5]we can find Hermitian F and G such that [F, G] = iH, and 11^11, ||G|| < c gc ny/e 
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for Cg C » ~ c? 1//4 ^/((i — l)/2. Setting V = exp(iF) 7 W = exp(iG), S = c gc »y/e and applying 
Lemma we obtain: 

d(VWV^W\U) < ci(c gc »Vi) 3 = c e& e 3/2 , (33) 

where c gc < = cic 3 c „ w 4d 3/4 ((d - l)/2) 3/2 . Furthermore, we have d(I, V), d(I, W) < c gc »^/e, 
as desired. 

6 Prior work 

The treatment of the SK theorem and algorithm given in this paper is based upon Appendix 3 
in |19| . That appendix gave a detailed description of the SK theorem, and included an exercise 
(Exercise A3. 6) asking the reader to find an algorithm for efficiently finding accurate sequences 
of instructions approximating a desired unitary. Reader feedback on 19 suggests that this 
was not one of the easier exercises in that volume, a fact that partially inspired the present 
review paper. 

The history of the SK theorem and algorithm is interesting. For SU(2) the SK theorem 
was announced by Solovay in 1995 on an email discussion list, but no paper has subsequently 
appeared. Independently, in 1997 Kitaev |12j outlined a proof in a review paper, for the gen- 
eral case of SU(d). After hearing of this result, Solovay announced that he had generalized his 
proof in a similar fashion. Kitaev's paper also addressed the question of efficient implementa- 
tion, sketching out an algorithm to quickly find accurate instruction sequences approximating 
a desired gate. The proof of the SK theorem given in was based on , discussions with 
Kitaev, Solovay, and M. Freedman, and on a 1999 lecture by Freedman, based on Kitaev's 
proof. 

Kitaev's 1997 discussion ^2] of the SK theorem and algorithm is described and extended 
in the 2002 text by Kitaev, Shen and Vyalyi Indeed, that text actually presents two 

different approaches to the problem. The first approach, described in Section 8.3 of [TJ, uses 
very similar ideas to the description we have given, with a few technical differences resulting 
in somewhat different behaviour for the algorithm's running time, and for the length of the 
instruction sequences produced. In particular, the algorithm in |14j has a running time 
0(\og 3+S (1/e)) and produces an instruction sequence of length 0(log 3+l5 (l/e), where S can 
be chosen to be any positive real number. 

The second approach, described in Section 13.7 of |14) . is quite different in flavour. It 
modifies our setting for the SK theorem and algorithm in two ways: (1) it makes use of 
ancilla qubits, and (2) it constrains the allowed instruction set somewhat, for example, 
to Clifford group gates, together with the Toffoli gate; certain other instruction sets are 
also possible, but not an arbitrary instruction set. A variant of Kitaev's phase estima- 
tion algorithm [151 113j is used to construct instruction sequences providing exponentially 
accurate conditional phase shifts. Standard constructions (e.g. j2J), together with these 
phase shift gates, can then be used to approximate the desired gates. The running time 
for this approach is 0(log 2 (l/e) log(log(l/e))), and the length of the instruction sequence is 
0(log (1/e) log(log(l/e))). This approach also has the advantage of being easily parallelizable, 
when acting on multiple qubits. 

A non-constructive approach to the SK theorem was taken by Harrow, Recht and Chuang 
in UU, based on Harrow's undergraduate thesis [IQJ and papers by Arnold and Krylov p^, 
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and by Lubotsky, Phillips and Sarnak (171 118| (c.f. [H])- In particular, [H] proves that for 
a suitable choice of instruction set, an approximation of accuracy e may be achieved using 
a sequence of 0(log(l/e)) instructions. It does not yet seem to be well understood exactly 
which instruction sets achieve such a fast rate of convergence. Furthermore, jH] describe a 
simple volume argument establishing that, up to a constant factor, it is not possible to obtain 
shorter approximating sequences, and so this result is optimal. However, they do not provide 
a constructive means of efficiently finding these short instruction sequences. 

We conclude by noting two papers that, while not directly concerned with the SK theorem 
or algorithm, are likely of interest to anyone interested in quantum compilation. The first is a 
paper by Freedman, Kitaev, and Lurie [5], who develop some general conditions under which 
a subset Q of a semisimple Lie group G must generate a dense subset of G. In particular, they 
introduce a natural family of metrics defined for any semisimple Lie group G, and show that 
there is a universal constant c, independent of G, so that provided all points in G are within 
a distance c of Q, then Q must generate a dense subset of G. Roughly speaking, provided Q 
"fills" G sufficiently well, it is guaranteed to generate a dense subset of G. 

The second paper of interest is by Fowler 0], who investigates the feasibility of compil- 
ing Shor's algorithm into fault-tolerant form using a search technique that, while while not 
"efficient" in the sense of the SK algorithm, in practice seems to yield promising results. 

7 Conclusion 

The Solovay-Kitaev theorem and algorithm are fundamental results in the theory of quan- 
tum computation, and it seems likely that variants of these results will be used in future 
implementations of quantum computers to compile quantum algorithms such as Shor's into a 
fault-tolerant form. The discussion of these results in the present review paper has been ped- 
agogical, aimed at a formulation that brings out the key ideas, rather than being optimized 
for accuracy and efficiency. It is an interesting open problem to determine the extent to which 
these constructions can be improved, perhaps even developing a version of the Solovay-Kitaev 
algorithm achieving optimal or near-optimal accuracy and efficiency. 
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